From ab9c2b444bf2f632b20f56069cfa679ae8bbe214 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Mon, 26 Oct 2026 23:28:44 -0700
Subject: [PATCH] fix(iam): make the SMTP->Gotify relay actually push

Two defects in the first cut, both silent from the sender's side because the
relay answers 250 either way:

- GOTIFY_URL needs a trailing slash; without it the push has no path.
- GOTIFY_TITLE_TEMPLATE referenced .Subject, which the relay does not expose,
  so template execution failed.

The relay's default title already carries the subject, so drop the template.

Also register the SOPS file in secret-generator.yaml: the sops-secrets app only
renders files listed there, so the Secret was never created and the relay sat in
CreateContainerConfigError.
---
 k8s/argocd/secrets/secret-generator.yaml |  1 +
 k8s/infra/iam/smtp-gotify.yaml           | 10 +++++-----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/k8s/argocd/secrets/secret-generator.yaml b/k8s/argocd/secrets/secret-generator.yaml
index 7313d38..77211d2 100644
--- a/k8s/argocd/secrets/secret-generator.yaml
+++ b/k8s/argocd/secrets/secret-generator.yaml
@@ -35,6 +35,7 @@ files:
     - pi-sandbox-secrets.enc.yaml
     - etcd-defrag-creds.enc.yaml
     - zitadel-masterkey.enc.yaml
+    - smtp-gotify-secrets.enc.yaml
     # Login UI RSA keypair, adopted from the chart-generated Secret so ArgoCD
     # owns it. Without this, the chart re-generates the keypair on every render,
     # which changes checksum/secret-login-service-key and leaves both Zitadel
diff --git a/k8s/infra/iam/smtp-gotify.yaml b/k8s/infra/iam/smtp-gotify.yaml
index 38a2949..6918f34 100644
--- a/k8s/infra/iam/smtp-gotify.yaml
+++ b/k8s/infra/iam/smtp-gotify.yaml
@@ -42,7 +42,7 @@ spec:
           imagePullPolicy: IfNotPresent
           env:
             - name: GOTIFY_URL
-              value: "http://gotify.notifications.svc.cluster.local"
+              value: "http://gotify.notifications.svc.cluster.local/"
             - name: GOTIFY_TOKEN
               valueFrom:
                 secretKeyRef:
@@ -50,10 +50,10 @@ spec:
                   key: token
             - name: GOTIFY_PRIORITY
               value: "5"
-            # ZITADEL sends "ZITADEL - Verify email" style subjects; keep them
-            # so the phone notification says what it is.
-            - name: GOTIFY_TITLE_TEMPLATE
-              value: "{{.Subject}}"
+            # No title template: the relay's default title already carries
+            # the mail subject, and a wrong template field fails the push
+            # silently (the SMTP side still answers 250, so the sender thinks
+            # the message was delivered).
           ports:
             - name: smtp
               containerPort: 2525